enigma-memory 0.1.18 → 0.1.22

package/specs/evidence-packet-v1.schema.json

@@ -0,0 +1,177 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/evidence-packet-v1.schema.json",
+  "title": "Enigma Evidence Packet v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "packet_id",
+    "generated_at",
+    "packet_root",
+    "issuer_ref",
+    "subject_refs",
+    "claim_ids",
+    "evidence_refs",
+    "artifact_refs",
+    "trust_card_refs",
+    "posture_summaries",
+    "roots",
+    "signatures",
+    "boundary"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.evidence_packet.v1" },
+    "packet_id": { "$ref": "#/$defs/publicId" },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "packet_root": { "$ref": "#/$defs/sha256Digest" },
+    "issuer_ref": { "$ref": "#/$defs/publicRef" },
+    "subject_refs": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/publicRef" },
+      "uniqueItems": true
+    },
+    "claim_ids": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/claimId" },
+      "uniqueItems": true
+    },
+    "evidence_refs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/publicRef" },
+      "uniqueItems": true
+    },
+    "artifact_refs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/artifactRef" }
+    },
+    "trust_card_refs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/publicRef" },
+      "uniqueItems": true
+    },
+    "posture_summaries": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/postureSummary" }
+    },
+    "roots": { "$ref": "#/$defs/evidenceRoots" },
+    "signatures": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/signatureRef" }
+    },
+    "boundary": { "$ref": "#/$defs/evidenceBoundary" }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "publicId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{7,127}$" },
+    "publicRef": { "type": "string", "pattern": "^ref:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,255}$" },
+    "claimId": { "type": "string", "pattern": "^claim:[a-z0-9][a-z0-9._:-]{2,127}$" },
+    "schemaId": { "type": "string", "pattern": "^enigma\\.[a-z0-9_]+\\.v1$" },
+    "signerRef": { "type": "string", "pattern": "^signer:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "signaturePublicRef": { "type": "string", "pattern": "^sigref:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "postureSummary": {
+      "type": "object",
+      "required": ["subject_type", "subject_ref", "posture", "claim_ids", "evidence_refs", "boundary"],
+      "additionalProperties": false,
+      "properties": {
+        "subject_type": { "type": "string", "enum": ["connector", "package"] },
+        "subject_ref": { "$ref": "#/$defs/publicRef" },
+        "posture": { "type": "string", "enum": ["unknown", "reviewed", "trusted", "quarantined", "blocked"] },
+        "claim_ids": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/claimId" },
+          "uniqueItems": true
+        },
+        "evidence_refs": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/publicRef" },
+          "uniqueItems": true
+        },
+        "boundary": { "$ref": "#/$defs/evidenceBoundary" }
+      }
+    },
+    "artifactRef": {
+      "type": "object",
+      "required": ["schema_id", "artifact_ref", "artifact_hash", "root", "claim_ids"],
+      "additionalProperties": false,
+      "properties": {
+        "schema_id": { "$ref": "#/$defs/schemaId" },
+        "artifact_ref": { "$ref": "#/$defs/publicRef" },
+        "artifact_hash": { "$ref": "#/$defs/sha256Digest" },
+        "root": { "$ref": "#/$defs/sha256Digest" },
+        "claim_ids": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/claimId" },
+          "uniqueItems": true
+        }
+      }
+    },
+    "evidenceRoots": {
+      "type": "object",
+      "required": ["claim_root", "evidence_ref_root", "artifact_root", "receipt_chain_root"],
+      "additionalProperties": false,
+      "properties": {
+        "claim_root": { "$ref": "#/$defs/sha256Digest" },
+        "evidence_ref_root": { "$ref": "#/$defs/sha256Digest" },
+        "artifact_root": { "$ref": "#/$defs/sha256Digest" },
+        "receipt_chain_root": { "$ref": "#/$defs/sha256Digest" }
+      }
+    },
+    "signatureRef": {
+      "type": "object",
+      "required": ["signer_ref", "signature_ref", "signature_hash", "alg"],
+      "additionalProperties": false,
+      "properties": {
+        "signer_ref": { "$ref": "#/$defs/signerRef" },
+        "signature_ref": { "$ref": "#/$defs/signaturePublicRef" },
+        "signature_hash": { "$ref": "#/$defs/sha256Digest" },
+        "alg": { "type": "string", "enum": ["Ed25519", "ECDSA-P256-SHA256"] }
+      }
+    },
+    "evidenceBoundary": {
+      "type": "object",
+      "required": [
+        "public_payload_only",
+        "raw_evidence_included",
+        "raw_memory_included",
+        "raw_prompt_included",
+        "raw_transcript_included",
+        "raw_embedding_included",
+        "provider_response_included",
+        "private_key_included",
+        "token_included",
+        "credential_included",
+        "local_path_included",
+        "provider_deletion_claim",
+        "model_forgetting_claim",
+        "hosted_saas_ready_claim",
+        "compliance_certification_claim",
+        "benchmark_superiority_claim"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "public_payload_only": { "const": true },
+        "raw_evidence_included": { "const": false },
+        "raw_memory_included": { "const": false },
+        "raw_prompt_included": { "const": false },
+        "raw_transcript_included": { "const": false },
+        "raw_embedding_included": { "const": false },
+        "provider_response_included": { "const": false },
+        "private_key_included": { "const": false },
+        "token_included": { "const": false },
+        "credential_included": { "const": false },
+        "local_path_included": { "const": false },
+        "provider_deletion_claim": { "const": false },
+        "model_forgetting_claim": { "const": false },
+        "hosted_saas_ready_claim": { "const": false },
+        "compliance_certification_claim": { "const": false },
+        "benchmark_superiority_claim": { "const": false }
+      }
+    }
+  }
+}

package/specs/hosted-backend-live-evidence-v1.schema.json

@@ -10,6 +10,8 @@
     "environment",
     "refs",
     "probes",
+    "runtime_capability",
+    "authenticated_data_plane",
     "operator_acceptance",
     "claim_boundary"
   ],
@@ -19,14 +21,15 @@
     "environment": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["environment_id", "domain", "cloud_provider", "region", "owner", "status"],
+      "required": ["environment_id", "domain", "cloud_provider", "region", "owner", "status", "local_simulation"],
       "properties": {
         "environment_id": { "type": "string", "minLength": 1 },
         "domain": { "type": "string", "minLength": 1 },
-        "cloud_provider": { "type": "string", "minLength": 1 },
+        "cloud_provider": { "type": "string", "minLength": 1, "not": { "const": "local" } },
         "region": { "type": "string", "minLength": 1 },
         "owner": { "type": "string", "minLength": 1 },
-        "status": { "enum": ["observed", "verified", "go", "accepted"] }
+        "status": { "enum": ["observed", "verified", "go", "accepted"] },
+        "local_simulation": { "const": false }
       }
     },
     "refs": {
@@ -98,6 +101,43 @@
         "gateway_readyz": { "$ref": "#/$defs/probe" }
       }
     },
+    "runtime_capability": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "marker", "observed_at", "services"],
+      "properties": {
+        "schema": { "const": "enigma.hosted_backend_runtime_capability.v1" },
+        "marker": { "const": "enigma.private_data_plane.runtime.v1" },
+        "observed_at": { "type": "string", "format": "date-time" },
+        "services": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["relay", "gateway"],
+          "properties": {
+            "relay": { "$ref": "#/$defs/runtimeService" },
+            "gateway": { "$ref": "#/$defs/runtimeService" }
+          }
+        }
+      }
+    },
+    "authenticated_data_plane": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "observed_at", "proofs"],
+      "properties": {
+        "schema": { "const": "enigma.hosted_backend_authenticated_data_plane.v1" },
+        "observed_at": { "type": "string", "format": "date-time" },
+        "proofs": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["relay", "gateway"],
+          "properties": {
+            "relay": { "$ref": "#/$defs/dataPlaneProof" },
+            "gateway": { "$ref": "#/$defs/dataPlaneProof" }
+          }
+        }
+      }
+    },
     "operator_acceptance": {
       "type": "object",
       "additionalProperties": false,
@@ -131,6 +171,35 @@
     }
   },
   "$defs": {
+    "runtimeService": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["service", "private_data_plane_operational", "authentication_enforced", "bootstrap_worker", "evidence_ref"],
+      "properties": {
+        "service": { "enum": ["enigma-relay", "enigma-gateway"] },
+        "private_data_plane_operational": { "const": true },
+        "authentication_enforced": { "const": true },
+        "bootstrap_worker": { "const": false },
+        "evidence_ref": { "type": "string", "minLength": 1 }
+      }
+    },
+    "dataPlaneProof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["service", "url", "method", "status_code", "authenticated", "authorization_result", "observed_at", "request_hash", "response_hash", "evidence_ref"],
+      "properties": {
+        "service": { "enum": ["enigma-relay", "enigma-gateway"] },
+        "url": { "type": "string", "format": "uri" },
+        "method": { "enum": ["GET", "POST", "PUT", "DELETE"] },
+        "status_code": { "type": "integer", "minimum": 200, "maximum": 299 },
+        "authenticated": { "const": true },
+        "authorization_result": { "const": "allowed" },
+        "observed_at": { "type": "string", "format": "date-time" },
+        "request_hash": { "type": "string", "pattern": "^sha256:[a-fA-F0-9]{64}$" },
+        "response_hash": { "type": "string", "pattern": "^sha256:[a-fA-F0-9]{64}$" },
+        "evidence_ref": { "type": "string", "minLength": 1 }
+      }
+    },
     "probe": {
       "type": "object",
       "additionalProperties": false,

package/specs/immune-scan-report-v1.schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/immune-scan-report-v1.schema.json",
+  "title": "Enigma Immune Scan Report v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "report_id",
+    "generated_at",
+    "scan_root",
+    "antigen_envelope_refs",
+    "detector_ids",
+    "findings",
+    "counts",
+    "status",
+    "quarantine_refs",
+    "roots",
+    "public_payload_only",
+    "private_payload_detected"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.immune_scan_report.v1" },
+    "report_id": { "$ref": "#/$defs/publicId" },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "scan_root": { "$ref": "#/$defs/sha256Digest" },
+    "antigen_envelope_refs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/publicRef" },
+      "uniqueItems": true
+    },
+    "detector_ids": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/detectorId" },
+      "uniqueItems": true
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/findingSummary" }
+    },
+    "counts": { "$ref": "#/$defs/scanCounts" },
+    "status": { "type": "string", "enum": ["clean", "flagged", "quarantined", "failed_closed"] },
+    "quarantine_refs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/publicRef" },
+      "uniqueItems": true
+    },
+    "roots": { "$ref": "#/$defs/scanRoots" },
+    "public_payload_only": { "const": true },
+    "private_payload_detected": { "const": false }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "publicId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{7,127}$" },
+    "publicRef": { "type": "string", "pattern": "^ref:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,255}$" },
+    "detectorId": { "type": "string", "pattern": "^detector:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "findingSummary": {
+      "type": "object",
+      "required": ["detector_id", "finding_ref", "finding_count", "status", "risk_labels"],
+      "additionalProperties": false,
+      "properties": {
+        "detector_id": { "$ref": "#/$defs/detectorId" },
+        "finding_ref": { "$ref": "#/$defs/publicRef" },
+        "finding_count": { "type": "integer", "minimum": 0 },
+        "status": { "type": "string", "enum": ["clean", "flagged", "quarantined", "failed_closed"] },
+        "risk_labels": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/riskLabel" },
+          "uniqueItems": true
+        }
+      }
+    },
+    "scanCounts": {
+      "type": "object",
+      "required": ["scanned", "flagged", "quarantined", "tombstoned", "detectors"],
+      "additionalProperties": false,
+      "properties": {
+        "scanned": { "type": "integer", "minimum": 0 },
+        "flagged": { "type": "integer", "minimum": 0 },
+        "quarantined": { "type": "integer", "minimum": 0 },
+        "tombstoned": { "type": "integer", "minimum": 0 },
+        "detectors": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "scanRoots": {
+      "type": "object",
+      "required": ["finding_root", "receipt_chain_root", "active_root", "quarantine_root", "tombstone_root"],
+      "additionalProperties": false,
+      "properties": {
+        "finding_root": { "$ref": "#/$defs/sha256Digest" },
+        "receipt_chain_root": { "$ref": "#/$defs/sha256Digest" },
+        "active_root": { "$ref": "#/$defs/sha256Digest" },
+        "quarantine_root": { "$ref": "#/$defs/sha256Digest" },
+        "tombstone_root": { "$ref": "#/$defs/sha256Digest" }
+      }
+    },
+    "riskLabel": {
+      "type": "string",
+      "enum": [
+        "benign",
+        "untrusted_origin",
+        "prompt_injection",
+        "data_exfiltration",
+        "secret_material",
+        "memory_poisoning",
+        "policy_violation",
+        "unknown"
+      ]
+    }
+  }
+}

package/specs/lifecycle-receipt-log-v1.schema.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/lifecycle-receipt-log-v1.schema.json",
+  "title": "Enigma Lifecycle Receipt Log v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "log_id",
+    "log_ref",
+    "subject_ref",
+    "tenant_ref",
+    "epoch",
+    "previous_log_root",
+    "receipt_refs",
+    "active_root",
+    "quarantine_root",
+    "tombstone_root",
+    "receipt_log_root",
+    "issued_at",
+    "signer_ref",
+    "signature_ref"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.lifecycle_receipt_log.v1" },
+    "log_id": { "$ref": "#/$defs/publicId" },
+    "log_ref": { "$ref": "#/$defs/publicRef" },
+    "subject_ref": { "$ref": "#/$defs/publicRef" },
+    "tenant_ref": { "$ref": "#/$defs/publicRef" },
+    "epoch": { "type": "integer", "minimum": 0 },
+    "previous_log_root": { "$ref": "#/$defs/sha256Digest" },
+    "receipt_refs": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/orderedReceiptRef" }
+    },
+    "active_root": { "$ref": "#/$defs/sha256Digest" },
+    "quarantine_root": { "$ref": "#/$defs/sha256Digest" },
+    "tombstone_root": { "$ref": "#/$defs/sha256Digest" },
+    "receipt_log_root": { "$ref": "#/$defs/sha256Digest" },
+    "issued_at": { "type": "string", "format": "date-time" },
+    "signer_ref": { "$ref": "#/$defs/publicRef" },
+    "signature_ref": { "$ref": "#/$defs/publicRef" }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "genesisOrSha256Digest": { "type": "string", "pattern": "^(sha256:[a-f0-9]{64}|GENESIS)$" },
+    "publicId": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$" },
+    "publicRef": { "type": "string", "pattern": "^(?![A-Za-z]:$)[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    "orderedReceiptRef": {
+      "type": "object",
+      "required": ["sequence", "receipt_ref", "receipt_hash", "previous_receipt_hash", "lifecycle_state"],
+      "additionalProperties": false,
+      "properties": {
+        "sequence": { "type": "integer", "minimum": 0 },
+        "receipt_ref": { "$ref": "#/$defs/publicRef" },
+        "receipt_hash": { "$ref": "#/$defs/sha256Digest" },
+        "previous_receipt_hash": { "$ref": "#/$defs/genesisOrSha256Digest" },
+        "lifecycle_state": {
+          "type": "string",
+          "enum": ["active", "quarantine", "tombstone"]
+        }
+      }
+    }
+  }
+}

package/specs/memory-atom-v1.schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/memory-atom-v1.schema.json",
+  "title": "Enigma Memory Atom v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "atom_id",
+    "atom_ref",
+    "atom_commitment",
+    "subject_ref",
+    "tenant_ref",
+    "encrypted_content_ref",
+    "content_commitment",
+    "encryption_envelope_ref",
+    "lifecycle_state",
+    "active_root",
+    "quarantine_root",
+    "tombstone_root",
+    "receipt_log_root",
+    "created_receipt_ref",
+    "latest_receipt_ref",
+    "created_at",
+    "updated_at",
+    "signer_ref",
+    "signature_ref"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.memory_atom.v1" },
+    "atom_id": { "$ref": "#/$defs/publicId" },
+    "atom_ref": { "$ref": "#/$defs/publicRef" },
+    "atom_commitment": { "$ref": "#/$defs/sha256Digest" },
+    "subject_ref": { "$ref": "#/$defs/publicRef" },
+    "tenant_ref": { "$ref": "#/$defs/publicRef" },
+    "encrypted_content_ref": { "$ref": "#/$defs/publicRef" },
+    "content_commitment": { "$ref": "#/$defs/sha256Digest" },
+    "encryption_envelope_ref": { "$ref": "#/$defs/publicRef" },
+    "lifecycle_state": {
+      "type": "string",
+      "enum": ["active", "quarantine", "tombstone"]
+    },
+    "active_root": { "$ref": "#/$defs/sha256Digest" },
+    "quarantine_root": { "$ref": "#/$defs/sha256Digest" },
+    "tombstone_root": { "$ref": "#/$defs/sha256Digest" },
+    "receipt_log_root": { "$ref": "#/$defs/sha256Digest" },
+    "created_receipt_ref": { "$ref": "#/$defs/publicRef" },
+    "latest_receipt_ref": { "$ref": "#/$defs/publicRef" },
+    "created_at": { "type": "string", "format": "date-time" },
+    "updated_at": { "type": "string", "format": "date-time" },
+    "signer_ref": { "$ref": "#/$defs/publicRef" },
+    "signature_ref": { "$ref": "#/$defs/publicRef" }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "publicId": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$" },
+    "publicRef": { "type": "string", "pattern": "^(?![A-Za-z]:$)[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" }
+  }
+}

package/specs/memory-event-v1.schema.json

@@ -1,42 +1,42 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.enigma.ai/memory-event-v1.schema.json",
-  "title": "Enigma Memory Event v1",
-  "type": "object",
-  "required": [
-    "schema",
-    "event_id",
-    "operation",
-    "tenant_id",
-    "subject_id",
-    "actor_id",
-    "timestamp",
-    "sequence",
-    "policy_id"
-  ],
-  "additionalProperties": false,
-  "properties": {
-    "schema": { "const": "enigma.memory_event.v1" },
-    "event_id": { "type": "string", "minLength": 8 },
-    "operation": {
-      "type": "string",
-      "enum": ["create", "read", "update", "supersede", "delete", "retrieve", "inject", "export", "import", "deny", "quarantine", "boundary_cross"]
-    },
-    "tenant_id": { "type": "string", "minLength": 1 },
-    "subject_id": { "type": "string", "minLength": 1 },
-    "actor_id": { "type": "string", "minLength": 1 },
-    "memory_addr": { "type": "string", "pattern": "^[a-z0-9_.:-]+$" },
-    "source_addr": { "type": "string", "pattern": "^[a-z0-9_.:-]+$" },
-    "provider": { "type": "string" },
-    "model": { "type": "string" },
-    "purpose": { "type": "string" },
-    "timestamp": { "type": "string", "format": "date-time" },
-    "sequence": { "type": "integer", "minimum": 0 },
-    "policy_id": { "type": "string", "minLength": 1 },
-    "decision": { "type": "string", "enum": ["allow", "deny", "quarantine", "out_of_scope"] },
-    "metadata": {
-      "type": "object",
-      "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/memory-event-v1.schema.json",
+  "title": "Enigma Memory Event v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "event_id",
+    "operation",
+    "tenant_id",
+    "subject_id",
+    "actor_id",
+    "timestamp",
+    "sequence",
+    "policy_id"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.memory_event.v1" },
+    "event_id": { "type": "string", "minLength": 8 },
+    "operation": {
+      "type": "string",
+      "enum": ["create", "read", "update", "supersede", "delete", "retrieve", "inject", "export", "import", "deny", "quarantine", "boundary_cross"]
+    },
+    "tenant_id": { "type": "string", "minLength": 1 },
+    "subject_id": { "type": "string", "minLength": 1 },
+    "actor_id": { "type": "string", "minLength": 1 },
+    "memory_addr": { "type": "string", "pattern": "^[a-z0-9_.:-]+$" },
+    "source_addr": { "type": "string", "pattern": "^[a-z0-9_.:-]+$" },
+    "provider": { "type": "string" },
+    "model": { "type": "string" },
+    "purpose": { "type": "string" },
+    "timestamp": { "type": "string", "format": "date-time" },
+    "sequence": { "type": "integer", "minimum": 0 },
+    "policy_id": { "type": "string", "minLength": 1 },
+    "decision": { "type": "string", "enum": ["allow", "deny", "quarantine", "out_of_scope"] },
+    "metadata": {
+      "type": "object",
+      "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
+    }
+  }
+}